This advisory covers two vulnerabilities in Red Hat OpenStack Platform 17.1's osp-director-operator container. CVE-2025-21613 involves argument injection through the URL field, categorized under CWE-88 (Argument Injection). CVE-2025-21614 affects go-git clients, which can be subjected to denial of service via maliciously crafted Git server replies, related to CWE-770 (Allocation of Resources Without Limits or Throttling). Red Hat has released an update to address these issues, rated with an overall security impact of Important. The vulnerabilities impact the Red Hat OpenStack Platform 17.1 running on RHEL 9 x86_64 architectures. Detailed remediation instructions are available in the Red Hat advisory.

The vulnerabilities could allow an attacker to perform argument injection via the URL field, potentially leading to unintended command execution or manipulation within the affected component. The go-git client vulnerability could allow denial of service by sending crafted responses from a malicious Git server, disrupting normal operations. These issues may affect the stability and security of the Red Hat OpenStack Platform 17.1 environment. There are no reports of active exploitation in the wild. The overall impact is rated as Important by Red Hat.

Red Hat has released an official security update for the osp-director-operator container in Red Hat OpenStack Platform 17.1. Users should apply this update promptly following the instructions provided in the Red Hat advisory at https://access.redhat.com/articles/11258. This update addresses both CVE-2025-21613 and CVE-2025-21614. No additional mitigation steps are indicated beyond applying the vendor-provided update.